vdb

vdb-mcp

mcp-name: kr.ai.vdb/vdb

MCP (Model Context Protocol) server for VDB — the AI-aware vulnerability database. Lets Claude Desktop, Claude Code, Cursor, Cline, Continue, and any MCP client check packages while generating code: known CVEs, slopsquatting (LLM-hallucinated package names an attacker may have registered), CISA KEV status, MCP-server trust profiles, and more.

Quick start

uvx vdb-mcp          # or: pipx run vdb-mcp

Claude Desktop (claude_desktop_config.json) / Cursor (.cursor/mcp.json):

{
  "mcpServers": {
    "vdb": { "command": "uvx", "args": ["vdb-mcp"] }
  }
}

No install at all — point any streamable-HTTP MCP client at the hosted endpoint:

{
  "mcpServers": {
    "vdb": { "url": "https://vdb.ai.kr/mcp" }
  }
}

That's it — the server talks to the hosted instance at https://vdb.ai.kr by default. Anonymous use gets a free per-IP trial; add an API key for unmetered access (free at https://vdb.ai.kr/signup):

{
  "mcpServers": {
    "vdb": {
      "command": "uvx",
      "args": ["vdb-mcp"],
      "env": { "VDB_API_TOKEN": "vdb_..." }
    }
  }
}

Tools

Tool	What it does
vdb_check_package	Check one package (purl + optional version) for vulnerabilities, slop risk, KEV
vdb_check_packages	Bulk slopsquatting / risk check for a list of packages
vdb_lookup	Fetch one advisory by ID (CVE-…, GHSA-…, VDB-SLOP-…)
vdb_search	Free-text search over the vulnerability corpus
vdb_check_mcp_server	Trust tier + permission scopes of a community MCP server
vdb_list_slopsquatting	Current slopsquatting candidates per ecosystem

Environment

Variable	Default	Meaning
VDB_API_URL	https://vdb.ai.kr	VDB instance to query (set for self-hosted)
VDB_API_TOKEN	(empty)	vdb_… API key — unmetered, per-account quota
MCP_MODE	stdio	stdio or sse (long-running HTTP server)
MCP_PORT	7700	SSE port

Why

LLMs hallucinate package names; attackers register them (slopsquatting). LLMs also happily recommend packages with known RCEs. VDB gives your agent a guardrail: one tool call before npm install / pip install. See https://vdb.ai.kr/connect for the one-line prompt variant that needs no MCP at all.

License

Elastic License 2.0 — free to use, including inside commercial organizations and CI. The only restrictions: you may not offer this software to third parties as a hosted or managed service, or resell it as a product. Commercial licensing beyond that: dev@egdee.com. API usage is governed by the VDB service terms regardless of how you call it.